package com.Unidbg_hengdin.mfw;

import com.alibaba.fastjson.util.IOUtils;
import com.bytedance.frameworks.core.encrypt.TTEncrypt;
import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.Symbol;
import com.github.unidbg.arm.HookStatus;
import com.github.unidbg.arm.backend.Unicorn2Factory;
import com.github.unidbg.arm.context.Arm32RegisterContext;
import com.github.unidbg.arm.context.RegisterContext;
import com.github.unidbg.debugger.BreakPointCallback;
import com.github.unidbg.debugger.DebuggerType;
import com.github.unidbg.hook.HookContext;
import com.github.unidbg.hook.ReplaceCallback;
import com.github.unidbg.hook.hookzz.Dobby;
import com.github.unidbg.hook.hookzz.HookEntryInfo;
import com.github.unidbg.hook.hookzz.HookZz;
import com.github.unidbg.hook.hookzz.IHookZz;
import com.github.unidbg.hook.hookzz.InstrumentCallback;
import com.github.unidbg.hook.hookzz.WrapCallback;
import com.github.unidbg.hook.xhook.IxHook;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.XHookImpl;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.array.ByteArray;
import com.github.unidbg.memory.Memory;
import com.github.unidbg.utils.Inspector;
import com.sun.jna.Pointer;
import unicorn.ArmConst;

import java.io.File;
public class mfwNative extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;

    private final DvmClass AuthorizeHelper;

    private final boolean logging;

    mfwNative(boolean logging) {
        this.logging = logging;

        emulator = AndroidEmulatorBuilder.for32Bit()
                .setProcessName("com.mfw.roadbook")
                .addBackendFactory(new Unicorn2Factory(true))
                .build(); // 创建模拟器实例，要模拟32位或者64位，在这里区分
        final Memory memory = emulator.getMemory(); // 模拟器的内存操作接口
        memory.setLibraryResolver(new AndroidResolver(23)); // 设置系统类库解析

        vm = emulator.createDalvikVM(); // 创建Android虚拟机
        vm.setJni(this);
        vm.setVerbose(logging); // 设置是否打印Jni调用细节
        DalvikModule dm = vm.loadLibrary(new File("unidbg-android/src/test/java/com/Unidbg_hengdin/mfw/libmfw.so"), false); // 加载libttEncrypt.so到unicorn虚拟内存，加载成功以后会默认调用init_array等函数
        dm.callJNI_OnLoad(emulator); // 手动执行JNI_OnLoad函数
        module = dm.getModule(); // 加载好的libttEncrypt.so对应为一个模块

        // Java_com_mfw_tnative_AuthorizeHelper_xAuthencode
        AuthorizeHelper = vm.resolveClass("com/mfw/tnative/AuthorizeHelper");
    }

    void destroy() {
        IOUtils.close(emulator);
        if (logging) {
            System.out.println("destroy");
        }
    }

    public static void main(String[] args) throws Exception {
        mfwNative test = new mfwNative(true);

        test.callFunc();

        test.destroy();
    }

    void callFunc() {
        String data = "PUT&https%3A%2F%2Fmapi.mafengwo.cn%2Frest%2Fapp%2Fuser%2Flogin%2F&after_style%3Ddefault%26app_code%3Dcom.mfw.roadbook%26app_ver%3D8.1.6%26app_version_code%3D535%26brand%3Dgoogle%26channel_id%3DGROWTH-WAP-LC-3%26device_id%3DAC%253A37%253A43%253A49%253A8F%253AF8%26device_type%3Dandroid%26hardware_model%3DPixel%26mfwsdk_ver%3D20140507%26o_lat%3D39.906864%26o_lng%3D116.216477%26oauth_consumer_key%3D5%26oauth_nonce%3Dc3a27ff5-1427-4976-bd90-cae7531be31a%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1701144509%26oauth_version%3D1.0%26open_udid%3DAC%253A37%253A43%253A49%253A8F%253AF8%26put_style%3Ddefault%26screen_height%3D1794%26screen_scale%3D2.625%26screen_width%3D1080%26sys_ver%3D10%26time_offset%3D480%26x_auth_mode%3Dclient_auth%26x_auth_password%3Da11111111%26x_auth_username%3D15330059026";

        emulator.attach().addBreakPoint(module.base + 0x914C, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                emulator.getBackend().reg_write(ArmConst.UC_ARM_REG_PC,address+4+1); // 跳过这个函数的调用
                emulator.getBackend().reg_write(ArmConst.UC_ARM_REG_R0,1); // 修改r0的值
                return true;
            }
        });

        StringObject res = AuthorizeHelper.callStaticJniMethodObject(
                emulator,
                "xAuthencode([android/content/context;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)Ljava/lang/String",
                vm.addLocalObject(vm.resolveClass("android/content/Context")),
                new StringObject(vm,data),
                new StringObject(vm,""),
                new StringObject(vm,"com.mfw.roadbook"),
                true
        ); // 执行Jni方法
//        return array.getValue();
        System.out.println(res.getValue());
    }

    @Override
    public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
        if ("java/lang/Class->getPackageManager()Landroid/content/pm/PackageManager;".equals(signature)){
            System.out.println("------------");
            return new StringObject(vm,"com.mfw.roadbook");
        }
        return super.callObjectMethodV(vm, dvmObject, signature, vaList);
    }


}
